Information Security Fundamentals Quiz

Part I - The Challenges

• Information and intellectual capital are more valuable to a company than physical assets
• Most organizations believe their information systems are secure, but this is not the reality
• Information security needs a layered approach to protecting many different forms of information
• Threats to information involve various forms including theft, solicitation, and hostile interception,
• Espionage by foreign governments happens on a large scale to gain economic advantage; this involves front companies, joint ventures, or suppliers to the target.
• Government-level espionage isn't limited to traditional adversaries
• Industrial espionage happens between various countries and companies
• Companies and employees can steal information, leading to many risks to organizations

Competitive Intelligence

• Espionage is often confused with competitive intelligence (CI)
• CI examines the strengths and weaknesses of competitors
• It is challenging to draw a clear line between legitimate CI and illegally acquiring intellectual property.

Cyber Sabotage

• Denying access to data is damaging to organizations, and in some cases, more so than theft
• 46% of UK companies surveyed experienced a cyber security breach in 2017
• Temporary loss of network/file access and corrupted systems are the most common outcomes of cyberattacks
• The WannaCry ransomware attack encrypted machines and demanded ransom from over 230,000 computers.

The CIA triad

• Confidentiality, Integrity, and Availability (CIA) are fundamental to information security
• Confidentiality: Restricted access to information for only authorized personnel and with need for the information
• Integrity: Guaranteeing that information isn't altered, modified or manipulated in unauthorised ways
• Availability: Ensuring the continued, uninterrupted accessibility of information to authorized users.

The Threat Tempo

• The threat tempo is increasing due to the rapid evolution of technology
• New technologies and cyberattack methods rapidly increase
• The security industry must constantly adapt to these new challenges.

Specific Idiosyncrasies of Information as an Asset

• Information can take various forms, from spoken word to computer data
• Intangible information is hard to effectively protect
• Difficulty in accounting for all information assets.

The Information Lifecycle

• Information takes different forms throughout its lifecycle
• Information can be converted from handwriting to digital formats and stored in various ways
• Many parties may access and share information, raising concerns for security

The Adversaries

• Outsiders, malicious insiders, inadvertent disclosure, and collusion with outsiders are all types of adversaries, although these categories may be too simplistic to capture the full adversary landscape
• Employees: Staff are frequently the target of espionage attempts
• Competitors: Companies spy on one another using many methods
• Business Partners: Businesses often trust their partners, creating an opportunity for threats arising from their employees
• Foreign Governments: Foreign governments frequently target competitor companies for economic espionage, often targeting employees.
• Journalists: News organizations and journalists can pose threats when sensitive information is leaked in pursuit of their stories.
• Activists: Individuals opposed to certain entities are a potential source of threats, especially those active in cyberspace
• Criminals: Criminals may want the data for identity theft or other criminal enterprises

Insider Threat

• Insiders are particularly risky and pose a difficult threat to mitigate.
• Employees, former employees, contractors and business partners can be malicious insiders
• The loss or modification of information by an insider can have a large impact on organizations
• A common motivation for insider threats is the intent to support competitors or outside entities when moving to a new job opportunity
• The risk of insider threats is amplified due to current business requirements for mobility and remote technology support

Basic Protection Principles

• Basic protection principles can be summarized with TRAPP: Technology, Response, Awareness, Procedures and Programmes, Physical security
• Information classification can help people determine what information is sensitive
• Some information systems are more important to organizations than others
• Procedures and programming strategies are important elements of protecting information and systems
• The effectiveness of many security measures depends on a strong company culture

Operational Security (OpSec)

• OpSec protects non-sensitive information that can still reveal an organization's operations, capabilities intentions, and goals;
• OpSec can include basic measures such as clear desk policies, limiting who has access to certain information,
• Careful physical security of equipment and personnel is important
• OpSec is crucial in managing risks to employees who are overseas, especially when they have access to sensitive information.

Incident Response and Investigations

• The risk of an information breach can never be fully eliminated
• It can be mitigated if a well-designed incident response plan is in place to identify, respond to, and follow up on an incident effectively
• The ideal response plan should include roles and responsibilities, risk assessment analysis, procedures for reporting incidents, plans for handling different scenarios, and scheduled training and exercises for improving response skills.